Russell has posted a note welcoming Leif to Digium:

Greetings,

Leif Madsen is a member of the Asterisk community that probably needs no introduction. He is a co-author of the Asterisk O'Reilly book, a highly respected Asterisk consultant, and a regular speaker at yearly Astricon events.

While Leif has been working for Digium for a while, he just joined the Software Development team a few months ago. Leif's role in our team is to use his experience to help improve our efforts in handling the issue tracker. He is the primary bug marshal and leads the effort on triage of incoming reports. He also spends a lot of time helping to identify and reproduce issues.

In addition to his work on the issue tracker, Leif will begin to take over some of the responsibilities related to the bug fix release cycle.

He will use his knowledge of what's coming through the issue tracker to coordinate maintenance releases of Asterisk (1.4.X, 1.6.0.X, etc.).

Please join me in welcoming Leif into his new role!

--
Russell Bryant
Senior Software Engineer
Open Source Team Lead
Digium, Inc.

VentureVoIP urgently needs a new Asterisk support officer. Preferably self taught.

The location for the job is Dunedin, New Zealand, although this is not 100% necessary.

Skills required include:

Asterisk
PHP
Linux
MySQL
Possibly C
Possibly Python

All enquiries should be sent as soon as possible to sales@venturevoip.com

The Asterisk development team is pleased to announce the release of versions 2.1.0 of both dahdi-linux and dahdi-tools:

DAHDI now includes a native driver for the B410P four port BRI module. The Digium Asterisk Hardware Device Interface (DAHDI) is a collection of drivers and utilities for connecting your Asterisk installation to the Public Switched Telephone Network (PSTN). dahdi-linux is the package that contains the Linux kernel modules while dahdi-tools contains the user mode scripts and utilities for working with dahdi-linux.

DAHDI is supported by Asterisk versions 1.4.22 and greater as well as Asterisk versions 1.6.0 and greater.

More detailed information about each of the packages is below.

====== dadhi-linux-2.1.0 ===================

Some of the highlights of the 2.1.0 release are:

• Added a new wcb4xxp driver to support ISDN BRI from within DAHDI.
  
• Added hooks to simplify end-user installation of OSLEC as an echo canceler.
  
• ...and various other bug fixes and improvements.

You can find the complete change log online

Known Issues:

• Reference counting is not currently done on echo canceller modules, and therefore it is possible for an administrator to unload an echo canceller module that is in use which could result in a crash. It is recommended to use /etc/init.d/dahdi start|stop to load and unload your drivers to eliminate exposure to this issue. Bug 13504.
  
• If you have configured your wcb4xxp spans and receive messages that "No D-channels available!", you might need to update your Asterisk installation in order to tell it to ignore the layer 1 link state on the BRI spans. Bug 14031.

===== dahdi-tools-2.1.0 ====================

Some of the highlights of the 2.1.0 release are:

• Added support for the new wcb4xxp driver.
  
• DTMF twist levels now meet the TBR-21 standard for EU countries.

You can find the complete change log online at:
http://downloads.digium.com/pub/telephony/dahdi-tools/ChangeLog-2.1.0

===== dahdi-linux-complete-2.1.0+2.1.0 =====

This release combines dahdi-linux and dahdi-tools into a single download, one-package installation process. Users who are installing DAHDI for the first time don't have to download and install the dahdi-linux and dahdi-tools packages separately.

Lenz has posted details of the latest release of QueueMetrics:

We are proud to announce that Queuemetrics 1.5.0 has been released.

This version adds a major new component called AGAW (Agent Awareness) that lets your agents see in real-time how they are faring comparing to their queue, and puts in place an IM infrastructure where agent-to-supervisor and agent-to-product-specialist communication can be completely off-band.

There is also a long list of new features and bugs fixed that should make this release interesting for most of you.

This release works with the same activation keys you used on your current version of QueueMetrics.

As always, we value your feedback on how to improve QueueMetrics to make it a better fit to your needs.

Enjoy the update,
Lorenzo Emilitri
Managing Director, Loway

*** New features

New features:
- AGAW module (see below)
- Massive data fetch from the database is now 20-30% faster and requires way less memory. (#461)
- Improved fetching logic now skips unused fields (#472)
- Audio files and data export now are saved with the correct name in all modern browsers (#486)
- It is now possible to do all call-listening activities from the Visitor's page, given the correct grants (#460)
- The wait-time alarm on calls in conversation can be turned off (#207)
- It is now possibe to disable the DBtest tool and the system information displayed on the Licence page (#411)
- It is now possible to reset the analysis to the default using the "Reload" icon on top (#27)
- The internationalization engine will fall-back to English if a translation is not complete at the time Q ships (#506)
- The QA module now offers average scores per queue (#361)
- It is possible to hide the technical details about QM in the configuration page (#411)
- Agents are now filtered alphabetically in the combo (#454)
- The Licence page now shows the currently used storage model. (#512)
- Once they have been used, action popups on the Agent's page will close down automatically in 30 seconds (#551)
- New icons used for inbound-outbound calls (#446)
- "Qualified Contacts" added and computed system-wide (#328)
- "Qualified conversions" added to the daily distribution page (#354, #355)
- Lost calls are removed when filetering on a specific agent (#356)
- Added new verb "ADDMEMBER2" to log the extension information along with the queue add information (#419)
- The "wrap time" can be computed on a given set of pauses

*** Bugs fixed over the previous releases

- Bugs #468 and #481: when multiple restriction criteria had no resulting overlapping set, all agents would be allowed instead of none. Fixed.
- Bug #471: The "max_bytes_agent" parameter would be used to refilter data fetched in MySQL mode.
- Bug #472: Useless verbs (RINGNOANSWER, AGENTATTEMPT, HEARTBEAT) are skipped when fetching in Agent mode.
- Bug #486: File names for file streaming are now correct even in Firefox.
- Bug #483: "Local/xxx" channels were sometimes shortened arbitrarily buy the parser
- Bug #511: The Number of CLID digits to search dropdown box did not show any digit
- Bug #536: Improved error logging
- Bug #543: Database updater
- Bug #247: The pause start time would be incorrect if multiple pause events were recorded
- Bug #93: You can now click on the "back-arrow" on the browser from the configuration subsystem
- Bug #393: Improved configuration editor
- Bug #378: The QA configuration editor would sometimes break
- Bug #416: The table definition for the queue_log table has been improved to allow for long URLs storage
- Bug #432: CSS file was incorrect for Firefox on Mac.
- Bug #449: Some fields would not show the correct background color in IE
- Bug #492: QM would crash trying to open the Call detail popup
- Bug #493: Improved QA captions to make it clearer
- Bug #554: Reduced useless logging
- Bug #540: The Red alarm would sometimes not play the correct audio file.
- Bug #155: Correct agent sorting
- Bug #357: Paging buttons now are on the top and on the bottom of a paged list
- Bug #377: Creating a new QA form, the "N Calls graded" field would be incorrectly loaded
- Bug #509: Going back from the "Unanswered calls" detail now goes to the "Unanswered calls" page
- Bug #264: The "unique_row_count" field may be missing from the queue_log table
- Bug #340: The "all selected" line in the Realtime page would sometimes be off.
- Bug #280: Buttons on top and on the bottom of the config editors.
- Bug #285: The editor page autofocus the first input box
- Bug #324: Title menu would sometimes break
- Bug #344: "Spill" and "Wrap" service groups were inverted
- Bug #358: The location code would be shown everywhwere and not its description. Fixed.
- Bug #382: Conting sales, contacts and QContacs could sometimes be off.
- Bug #396: Scrollbar added to the session list.
- Bug #560: the MySQL Storage page was not working in Opera 9. Now fixed.

*** Introducing the new AGAW module

QueueMetrics was designed primarily to be used by supervisors and administrators to keep track of what is going on in the Call Centre. In most Call-Centres, keeping track of the current activity level using a real-time wallboard and/or the agent’s page is enough. In some high- performance setups, with large and geographically distributed agent groups, it is mandatory to have a better lever of performance awareness by the agents, and to have “off band”, live communication lines going from the supervisor to the agent and from the agent to the supervisor.

QueueMetrics addresses this issue using a module called Agent Awareness (AGAW) , that is basically a Firefox plug-in that each agent can use to see:

- A wealth of information about how the agent and/or the queue is performing; this information offers a large set of performance metrics so that the feedback on the agent’s behaviour is immediate
- A way for the agent to get in touch with her supervisors using an off-band channel (chat) so that they can keep on working with no downtime when speaking to their supervisors or with second-line product experts
- A way for the supervisor to send targeted broadcast messages to his own agents, making it feasible to monitor geographically-dispersed agents

The choice of developing a Firefox plug-in was made because this way the agent can keep on working on a browser-based interface (CRM, data entry...) while keeping an eye on their own statistics in a non-obtrusive manner.

The AGAW subsystem is fully documented at page 72 of the latest version of the QueueMetrics User Manual. It will run with the supplied demo key for 2-agents, and will require a sepaarte activation key to be fully deployed. You can get a free demo key if you want to test it in your own environment.

*** Quality Assessment for everyone

Since version 1.5.0, the Quality Assessment module is now enabled by default on all new installs. This makes it very simple to keep track of how your agents are faring using a dedicated QA team.

If you do not see the new QA keys after you update to latest QM, make sure you check that your exising yusers have the required security keys needed to enable QA tracking and reviewing.

*** QueueMetrics translations

QueueMetrics is now available in the following languages:
- German
- English
- Spanish / Spain
- Spanish / Latin America
- Italian
- French
- Portuguese
- Polish
- Russian
- Dutch

Thanks to our translators for making it possible.

*** Updated user manuals

The QueueMetrics User manual has been upgraded and expanded to cover the new changes for 1.5, and now id almost 190-page long. It can be downloaded as a single PDF file or it can be viewed online on our website.

The user manual for the XML-RPC interface has been revised, now documenting fully the External Auth modules for integrating into a third-party auth mechanism (e.g. LDAP).

*** How to upgrade from a previous version

If you installed originally using yum, you should simply type:

yum update queuemetrics

and then point your browser to http://myserver:8080/queuemetrics/dbtest to update the database.

You should then copy the web.xml and configuration.properties from the old release to the new one.

Do not forget to make a backup copy of the database before running the update (just in case...)

Loway
via Ligornetto 17/a
6854 San Pietro
Switzerland

http://www.loway.ch
http://queuemetrics.com

All texts and data are copyright by Loway and may be re-used only with indication of their source.

John Todd has sent a detailed note to the Asterisk developers list regarding the recent security release. Please post this wherever you can:

On Friday, the IC3 (FBI/NW3C/BJA) put out a security advisory on their website that contained a fairly vaguely worded warning about Asterisk systems being compromised and then being used as "vishing" (voice phishing) platforms. They were non-specific on the threat other than to advocate upgrading to "newer versions" of Asterisk. This announcement was done on Friday late afternoon, just as everyone was leaving for the weekend, which left us leaving frantic messages with various IC3 voicemail system deadends and emails to generic-sounding accounts.

The delay in any authoritative information from IC3 quickly created a guessing game in the blogger and press community as to what was exactly the vulnerability and what were the details of this threat. The speculation here at Digium was that this was just a re-statement of an older bug from earlier this year, or it could have been entirely unrelated to Asterisk and just been a case of mis-diagnosis of poor password control.

It turns out that we were correct on our first guess: this is not a new problem, and furthermore is a difficult vulnerability to exploit even on those systems that are unpatched - it would require fairly purposeful configuration to expose the system to a "vishing" abuse method, so it is probably the case that this was a very isolated event. We spoke with IC3 agents earlier today, and they have updated the alert to contain the correct warning (AST-2008-003) which was their original intent.

There is a more complete description of the incident on the Digium blog site.

Other links:
AST-2008-003
Revised IC3 announcement

WHAT YOU CAN DO:
Unfortunately, the news of security risks spreads faster than the news of a non-issue - secure systems aren't "stories" so I expect it will be an uphill effort to update all the sites which copied or re-blogged the IC3 story initially. We would very much like to enlist the community to have you try to post where you can the link to the Digium blog above - it would help keep misperceptions from becoming part of the permanent data landscape as things get slowly archived into Google-able snippets. Post in the "Comments" sections of any blogs you see linking to this story, or put your own $.02 in as you see fit. We'd like to keep good relations with the IC3 and FBI, and we understand how this kind of mistake can happen (even though we're uncomfortable with the results) so please set your flamethrowers on "warm" instead of "scorch" if you choose to weigh in on the topic yourself.

If anyone has questions regarding this issue, please feel free to contact me via email or phone to discuss.

JT

---
John Todd
Asterisk Open Source Community Director